CKS_FINALE

submissions/CKS-016-skipped-by-topic-advance.md

@@ -0,0 +1,41 @@
+# CKS-016 — Replace cluster-admin with namespaced RBAC
+
+Domain: **2.1 Least-privilege RBAC**  
+Time: **5 minutes** · Score: **Section B only**
+
+## Existing dangerous binding
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: maya-admin
+subjects:
+- kind: User
+  name: maya
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+```
+
+## Task
+
+Remove this binding. In namespace `blue`, allow user `maya` only to:
+
+- `get`, `list`, and `watch` Pods;
+- `get` Pod logs.
+
+Create namespaced Role `maya-observer` and RoleBinding `maya-observer`. Include commands that verify one allowed action and that reading Secrets is denied.
+
+## Section B — scored answer
+
+```bash
+# Commands
+```
+
+```yaml
+# Complete Role and RoleBinding
+```
+
+Say **Grade CKS-016** when saved.